@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/signInProviders.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export declare const SIGN_IN_PROVIDER_IDS: readonly ["google", "microsoft", "github", "apple", "cloudflare", "oidc"];
+export type SignInProviderId = (typeof SIGN_IN_PROVIDER_IDS)[number];
+/** What a setting of a sign-in provider holds. */
+export type SignInSettingRole = "clientId" | "clientSecret" | "issuer" | "label" | "tenant";
+export interface SignInSetting {
+    /** `GOOGLE_SIGNIN_CLIENT_ID`. */
+    readonly name: string;
+    readonly role: SignInSettingRole;
+    /** Without it the provider is off (an incomplete set is reported). */
+    readonly required: boolean;
+    /**
+     * A plain value (an id, a URL, a word) `everyapp secret set` may show as
+     * typed; a credential stays hidden.
+     */
+    readonly plain: boolean;
+    /** One line: what to paste here. */
+    readonly what: string;
+}
+export interface SignInProvider {
+    readonly id: SignInProviderId;
+    /** The button: "Continue with <label>". The `oidc` entry's label is a setting. */
+    readonly label: string;
+    /** Where the OAuth app is created. */
+    readonly console: string;
+    /** What the OAuth app is called there ("OAuth client ID", "App registration"). */
+    readonly appNoun: string;
+    readonly settings: readonly SignInSetting[];
+    /** The scopes requested: identity only, nothing an app could act with. */
+    readonly scopes: readonly string[];
+    /** Which claim becomes the email, and what makes it count as verified. */
+    readonly emailClaim: string;
+    /** The everyapp skill's setup guide, relative to the skill. */
+    readonly setup: `setup/signin-${SignInProviderId}.md`;
+    /** Caveats worth a line in every listing. */
+    readonly notes: readonly string[];
+}
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export declare function signInCallbackPath(id: SignInProviderId): string;
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export declare function signInCallbackUrl(gatewayUrl: string, id: SignInProviderId): string;
+export declare const SIGN_IN_PROVIDERS: Readonly<Record<SignInProviderId, SignInProvider>>;
+/** The catalog in listing order. */
+export declare const SIGN_IN_PROVIDER_LIST: readonly SignInProvider[];
+export declare function isSignInProviderId(value: string): value is SignInProviderId;
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export declare const SIGN_IN_GATEWAY_SETTINGS: readonly string[];
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export declare const PLAIN_SIGN_IN_SETTINGS: readonly string[];
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export declare const SIGN_IN_SETTING_PATTERN: RegExp;
+export declare function isSignInSettingName(name: string): boolean;
+/** The provider a setting belongs to, if one reads it. */
+export declare function signInProviderOfSetting(name: string): SignInProvider | null;
+/** Whether a provider is on, off, or half set up, from which names are set. */
+export type SignInProviderStatus = "on" | "off" | "incomplete";
+export interface SignInProviderState {
+    readonly id: SignInProviderId;
+    readonly status: SignInProviderStatus;
+    /** The required settings not set (empty when on or off). */
+    readonly missing: readonly string[];
+    /** The settings set, required or not. */
+    readonly set: readonly string[];
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export declare function signInProviderState(provider: SignInProvider, isSet: (name: string) => boolean): SignInProviderState;
+//# sourceMappingURL=signInProviders.d.ts.map

package/dist/internal/signInProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInProviders.d.ts","sourceRoot":"","sources":["../../src/internal/signInProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,oBAAoB,2EAOvB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,gBAAgB,gBAAgB,KAAK,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,GAAG,MAAM,CAE/D;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,gBAAgB,GACnB,MAAM,CAER;AA8BD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CACtC,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAyIzC,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,qBAAqB,EAAE,SAAS,cAAc,EACF,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGnD,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKjD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QACsC,CAAC;AAE3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,0DAA0D;AAC1D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO3E;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,KAAK,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,mBAAmB,CAiBrB"}

package/dist/internal/signInProviders.js

@@ -0,0 +1,245 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export const SIGN_IN_PROVIDER_IDS = [
+    "google",
+    "microsoft",
+    "github",
+    "apple",
+    "cloudflare",
+    "oidc",
+];
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export function signInCallbackPath(id) {
+    return `/api/auth/callback/${id}`;
+}
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export function signInCallbackUrl(gatewayUrl, id) {
+    return `${gatewayUrl.replace(/\/+$/, "")}${signInCallbackPath(id)}`;
+}
+function settingName(id, field) {
+    return `${id.toUpperCase()}_SIGNIN_${field}`;
+}
+function clientPair(id, what) {
+    return [
+        {
+            name: settingName(id, "CLIENT_ID"),
+            role: "clientId",
+            required: true,
+            plain: true,
+            what: what.clientId,
+        },
+        {
+            name: settingName(id, "CLIENT_SECRET"),
+            role: "clientSecret",
+            required: true,
+            plain: false,
+            what: what.clientSecret,
+        },
+    ];
+}
+const IDENTITY_SCOPES = ["openid", "email", "profile"];
+export const SIGN_IN_PROVIDERS = {
+    google: {
+        id: "google",
+        label: "Google",
+        console: "https://console.cloud.google.com/apis/credentials",
+        appNoun: "OAuth client ID (Web application)",
+        settings: clientPair("google", {
+            clientId: "The OAuth client's Client ID (ends in .apps.googleusercontent.com)",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true (every Google account's own address is)",
+        setup: "setup/signin-google.md",
+        notes: [
+            "An OAuth consent screen still in Testing only signs in the test users listed on it; publish it for everyone else.",
+        ],
+    },
+    microsoft: {
+        id: "microsoft",
+        label: "Microsoft",
+        console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+        appNoun: "App registration",
+        settings: [
+            ...clientPair("microsoft", {
+                clientId: "The app registration's Application (client) ID",
+                clientSecret: "A client secret from Certificates & secrets (it expires; 24 months at most)",
+            }),
+            {
+                name: settingName("microsoft", "TENANT"),
+                role: "tenant",
+                required: false,
+                plain: true,
+                what: "The Directory (tenant) ID to pin sign-in to your own directory; unset means any Microsoft account (common), which then needs the xms_edov claim",
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified when MICROSOFT_SIGNIN_TENANT pins your own directory, or the token carries `xms_edov: true` (the optional claim that says the domain's owner verified it), `email_verified: true`, a matching `verified_primary_email`, or comes from a personal Microsoft account",
+        setup: "setup/signin-microsoft.md",
+        notes: [
+            "Without MICROSOFT_SIGNIN_TENANT, add the optional claims `email` and `xms_edov` under Token configuration, or every sign-in is refused as unverified: any tenant's admin can put any address on their users.",
+        ],
+    },
+    github: {
+        id: "github",
+        label: "GitHub",
+        console: "https://github.com/settings/developers",
+        appNoun: "OAuth App",
+        settings: clientPair("github", {
+            clientId: "The OAuth App's Client ID",
+            clientSecret: "A client secret generated on the OAuth App",
+        }),
+        scopes: ["read:user", "user:email"],
+        emailClaim: "the primary address from GitHub's emails API, counted as verified only when GitHub marks it verified",
+        setup: "setup/signin-github.md",
+        notes: [
+            "GitHub Apps are something else: make an OAuth App (Settings → Developer settings → OAuth Apps).",
+        ],
+    },
+    apple: {
+        id: "apple",
+        label: "Apple",
+        console: "https://developer.apple.com/account/resources/identifiers/list/serviceId",
+        appNoun: "Services ID",
+        settings: clientPair("apple", {
+            clientId: "The Services ID's identifier (com.example.gateway)",
+            clientSecret: "The client secret JWT you generate from your Sign in with Apple key (ES256; valid six months at most, then generate it again)",
+        }),
+        scopes: ["email", "name"],
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true; someone who chose Hide My Email arrives as a @privaterelay.appleid.com address, which no invitation names",
+        setup: "setup/signin-apple.md",
+        notes: [
+            "Apple returns to the Gateway with a POST; behind the outer ring, `everyapp access on` leaves /api/auth/callback/apple public (it only redirects to the same URL as a GET, which Access then checks).",
+            "The client secret is a JWT that expires within six months: generate a new one before then or sign-in stops.",
+        ],
+    },
+    cloudflare: {
+        id: "cloudflare",
+        label: "Cloudflare",
+        console: "https://dash.cloudflare.com/?to=/:account/oauth-clients",
+        appNoun: "OAuth client (Manage Account → OAuth clients)",
+        settings: clientPair("cloudflare", {
+            clientId: "The OAuth client's Client ID",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: ["user-details.read"],
+        emailClaim: "the Cloudflare API's /user `email` (the account's sign-in address). Cloudflare reports no verified flag, so the email counts as verified on the strength of the client being private: only members of your Cloudflare account can authorize it, and they got in by accepting an invitation sent to that address",
+        setup: "setup/signin-cloudflare.md",
+        notes: [
+            "Keep the client private (the default): a public client lets any Cloudflare user sign in, and Cloudflare says nothing about whether their address is verified. Making a client public is permanent.",
+            "The Cloudflare account's members sign in; for everyone else use Cloudflare Access's one-time PIN (`everyapp access on`) or another provider.",
+        ],
+    },
+    oidc: {
+        id: "oidc",
+        label: "SSO",
+        console: "your identity provider's admin console",
+        appNoun: "OpenID Connect client (web application, authorization code)",
+        settings: [
+            {
+                name: settingName("oidc", "ISSUER"),
+                role: "issuer",
+                required: true,
+                plain: true,
+                what: "The issuer URL (https://…), which serves /.well-known/openid-configuration",
+            },
+            ...clientPair("oidc", {
+                clientId: "The client ID",
+                clientSecret: "The client secret",
+            }),
+            {
+                name: settingName("oidc", "LABEL"),
+                role: "label",
+                required: false,
+                plain: true,
+                what: 'The button text after "Continue with" (default "SSO")',
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email` (else the userinfo endpoint's), counted as verified only when `email_verified` is true",
+        setup: "setup/signin-oidc.md",
+        notes: [
+            "Cloudflare Access has its own settings (CLOUDFLARE_ACCESS_OIDC_*, `everyapp access`): use those for Access, this for Okta, Keycloak, Auth0, Authentik, Google Workspace as an OIDC issuer and the like. For Microsoft Entra ID use the `microsoft` provider: Entra's ID tokens carry no `email_verified`, so through this entry every sign-in would be refused as unverified.",
+            "ID tokens must be signed with RS256 (every major provider's default).",
+        ],
+    },
+};
+/** The catalog in listing order. */
+export const SIGN_IN_PROVIDER_LIST = SIGN_IN_PROVIDER_IDS.map((id) => SIGN_IN_PROVIDERS[id]);
+export function isSignInProviderId(value) {
+    return SIGN_IN_PROVIDER_IDS.includes(value);
+}
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export const SIGN_IN_GATEWAY_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings.map((setting) => setting.name));
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export const PLAIN_SIGN_IN_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings
+    .filter((setting) => setting.plain)
+    .map((setting) => setting.name));
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export const SIGN_IN_SETTING_PATTERN = /^[A-Z][A-Z0-9_]*_SIGNIN_(CLIENT_ID|CLIENT_SECRET|ISSUER|LABEL|TENANT)$/;
+export function isSignInSettingName(name) {
+    return SIGN_IN_SETTING_PATTERN.test(name);
+}
+/** The provider a setting belongs to, if one reads it. */
+export function signInProviderOfSetting(name) {
+    for (const provider of SIGN_IN_PROVIDER_LIST) {
+        if (provider.settings.some((setting) => setting.name === name)) {
+            return provider;
+        }
+    }
+    return null;
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export function signInProviderState(provider, isSet) {
+    const set = provider.settings
+        .filter((setting) => isSet(setting.name))
+        .map((setting) => setting.name);
+    const unset = provider.settings
+        .filter((setting) => setting.required && !isSet(setting.name))
+        .map((setting) => setting.name);
+    const status = unset.length === 0 ? "on" : set.length === 0 ? "off" : "incomplete";
+    // `missing` names what a half-set provider still needs; a provider nobody
+    // started setting up isn't missing anything, it is off.
+    return {
+        id: provider.id,
+        status,
+        missing: status === "incomplete" ? unset : [],
+        set,
+    };
+}

package/dist/manifest.d.ts

@@ -0,0 +1,238 @@
+/**
+ * The manifest an app author writes as `everyapp.config.ts`, typed:
+ *
+ *   import { defineEveryApp } from "@every-app/sdk";
+ *
+ *   export default defineEveryApp({
+ *     id: "notes",
+ *     name: "Notes",
+ *     resources: { d1: ["DB"] },
+ *   });
+ *
+ * Types only, and a leaf module: `cloudflare.config.ts` imports the manifest,
+ * and the Cloudflare Vite plugin hides from the Worker every file the config
+ * imports. The rules beyond the shape (which ids exist, which names are
+ * reserved, which scope sets a provider has) are the CLI's: `everyapp deploy`
+ * and `everyapp dev` validate the manifest and say what is wrong. The
+ * perimeter's schema (`@every-app/perimeter/manifest`) is held to this type
+ * by a test there.
+ *
+ * The Worker reads the manifest back as `env.EVERYAPP_MANIFEST`, which
+ * `everyAppWorker()` sets and `cf workers types` types from the file.
+ */
+/** Why a setting is needed and whether the app opens without it (the settings model). */
+export interface EveryAppSettingNeed {
+    /** Why the app needs it, for whoever sets it. At most 200 characters. */
+    readonly why?: string;
+    /** An https page that says where the key or client comes from. */
+    readonly docs?: string;
+    /** The app opens without it; the feature using it says what is missing. */
+    readonly optional?: boolean;
+    /** The group of which one member is enough ("AI model"). */
+    readonly anyOf?: string;
+}
+/** A route reachable without a signed-in member. */
+export interface EveryAppPublicRoute {
+    /** Absolute glob: `*` matches one segment, `**` one or more. */
+    readonly path: string;
+    /** The methods it answers; `["GET"]` when left out. */
+    readonly methods?: readonly string[];
+}
+/** A Durable Object or Workflow class: its binding, the class, and the helper Worker that defines it. */
+export interface EveryAppClassResource {
+    readonly name: string;
+    readonly className: string;
+    readonly worker?: string;
+}
+/** A Cloudflare Queue's consumer settings. */
+export interface EveryAppQueueConsumer {
+    readonly worker?: string;
+    readonly maxBatchSize?: number;
+    readonly maxBatchTimeout?: number;
+    readonly maxRetries?: number;
+    readonly maxConcurrency?: number | null;
+    readonly retryDelay?: number;
+    readonly visibilityTimeoutMs?: number;
+    readonly deadLetterQueue?: string;
+}
+/** Cloudflare's limits for one of the app's Workers. */
+export interface EveryAppWorkerLimits {
+    /** CPU milliseconds an invocation may use, up to 300000. */
+    readonly cpuMs?: number;
+}
+/** The Cloudflare resources the app's Workers bind; the deploy creates them. */
+export interface EveryAppResources {
+    readonly d1?: readonly string[];
+    readonly kv?: readonly string[];
+    readonly r2?: readonly string[];
+    readonly durableObjects?: readonly EveryAppClassResource[];
+    readonly workflows?: readonly EveryAppClassResource[];
+    readonly hyperdrive?: readonly {
+        readonly name: string;
+        readonly worker?: string;
+        readonly caching?: "off" | "default";
+    }[];
+    readonly queues?: readonly {
+        readonly name: string;
+        readonly consumer?: true | EveryAppQueueConsumer;
+    }[];
+    readonly ai?: readonly string[];
+    readonly browser?: readonly string[];
+    readonly images?: readonly string[];
+    readonly vectorize?: readonly {
+        readonly name: string;
+        readonly dimensions?: number;
+        readonly metric?: "cosine" | "euclidean" | "dot-product";
+        /** A Workers AI embedding model's shape, instead of `dimensions` and `metric`. */
+        readonly preset?: "@cf/baai/bge-small-en-v1.5" | "@cf/baai/bge-base-en-v1.5" | "@cf/baai/bge-large-en-v1.5" | "openai/text-embedding-ada-002" | "cohere/embed-multilingual-v2.0";
+    }[];
+    readonly aiGateway?: readonly {
+        readonly name: string;
+        readonly collectLogs?: boolean;
+        readonly cacheTtl?: number;
+    }[];
+    readonly sendEmail?: readonly {
+        readonly name: string;
+        readonly allowedSenderAddresses: readonly string[];
+        readonly destinationAddress?: string;
+        readonly allowedDestinationAddresses?: readonly string[];
+    }[];
+    readonly secretsStore?: readonly {
+        readonly name: string;
+    }[];
+    readonly analyticsEngine?: readonly {
+        readonly name: string;
+        readonly dataset?: string;
+    }[];
+}
+/** One capability the Gateway serves the app with keys it holds. */
+export interface EveryAppCapabilityEntry extends EveryAppSettingNeed {
+    readonly access: "read" | "write";
+    /** An OAuth client's scope sets, by name (`["gmail.read"]`). */
+    readonly scopes?: readonly string[];
+}
+/**
+ * One of the app's plain settings: a value that isn't a secret and
+ * differs per install (a PostHog host, a region), set with `everyapp
+ * configure <app>` and read from `env`.
+ */
+export interface EveryAppSettingEntry {
+    readonly name: string;
+    /** Why the app needs it: what whoever installs the app reads. */
+    readonly why: string;
+    readonly docs?: string;
+    readonly optional?: boolean;
+    /** What it takes; text when not given. */
+    readonly type?: "text" | "url" | "number" | "boolean";
+    /** The values a text setting may take. */
+    readonly values?: readonly string[];
+    /** What the app reads while nobody has set it; the deploy writes it. */
+    readonly default?: string;
+}
+/** One of the app's own secrets, with its need. */
+export interface EveryAppSecretEntry extends EveryAppSettingNeed {
+    readonly name: string;
+    /** Its guide in the everyapp skill (`"setup/main-secret.md"`). */
+    readonly setup?: string;
+}
+/** `everyapp.config.ts`. */
+export interface EveryAppManifest {
+    /** Stable id, kebab-case: the app's hostname and Worker. */
+    readonly id: string;
+    readonly name?: string;
+    /** The one line the Gateway's app library shows under the name. */
+    readonly description?: string;
+    /** The path of an SVG the app serves (`"/everyapp-icon.svg"`). */
+    readonly icon?: string;
+    /** Legacy: the entry comes from `cloudflare.config.ts`. */
+    readonly main?: string;
+    /** YYYY-MM-DD. */
+    readonly compatibilityDate?: string;
+    readonly resources?: EveryAppResources;
+    /** Helper Workers deployed beside the app's as `<app worker>--<name>`. */
+    readonly workers?: readonly {
+        readonly name: string;
+        readonly binding?: string;
+        readonly limits?: EveryAppWorkerLimits;
+    }[];
+    readonly database?: {
+        readonly provider: "d1" | "postgres";
+        /** A cloud region such as `"aws:us-east-1"`. */
+        readonly region?: string;
+    };
+    readonly limits?: EveryAppWorkerLimits;
+    /** Routes open without a signed-in member. Default: none. */
+    readonly public?: readonly EveryAppPublicRoute[];
+    /**
+     * Static files of the asset bundle anyone may fetch (favicons, icons, an
+     * OG image): path patterns, GET and HEAD, never Worker code.
+     */
+    readonly publicAssets?: readonly string[];
+    /**
+     * Routes a bearer client (a native app, a script with a personal token)
+     * reaches with its token only: `paths` in `public`'s glob syntax, every
+     * method, and `why` the app needs them, shown to the operator. The
+     * Gateway answers 401 to a request carrying its session cookie there,
+     * and `everyapp access on` lets these paths through Cloudflare Access.
+     * Default: none.
+     */
+    readonly bearerRoutes?: {
+        readonly paths: readonly string[];
+        readonly why: string;
+    };
+    /** AI providers the Gateway calls for the app, by id or with their need. */
+    readonly providers?: readonly (string | (EveryAppSettingNeed & {
+        readonly id: string;
+    }))[];
+    /** Capabilities by id (`members`, `email`, `dataforseo`, …). */
+    readonly capabilities?: {
+        readonly [id: string]: EveryAppCapabilityEntry;
+    };
+    /** The app's own secrets, by name or with their need. */
+    readonly secrets?: readonly (string | EveryAppSecretEntry)[];
+    /** The app's plain settings: per-install values that aren't secrets. */
+    readonly settings?: readonly EveryAppSettingEntry[];
+    readonly ai?: {
+        /** Model ids the app may request; any other is `model_not_allowed`. */
+        readonly models?: readonly string[];
+        /** OpenAI API paths beyond inference (`"/v1/files"`). */
+        readonly routes?: readonly string[];
+        /** The app takes the Gateway's default chat model (`ai()`). */
+        readonly chat?: boolean | EveryAppSettingNeed;
+    };
+    /** `inbound: true`: the Worker exports an `email()` handler. */
+    readonly email?: {
+        readonly inbound?: boolean;
+    };
+    /** Who can open the app once registered; `"admins"` by default. */
+    readonly access?: "everyone" | "admins";
+    readonly serverFnGuard?: boolean;
+    readonly serverFnBase?: string;
+    /** Shell command that builds the app; `cf build` by default. */
+    readonly build?: string;
+    /** Shell command `everyapp dev` starts; it must listen on PORT. */
+    readonly dev?: string;
+    /** Legacy: the port comes from PORT. */
+    readonly devPort?: number;
+    /** Dependency install command; false skips it. */
+    readonly install?: false | string;
+    readonly migrations?: {
+        readonly engine: "drizzle" | "d1-sql" | "prisma";
+        readonly dialect?: "sqlite" | "postgresql";
+        readonly dir?: string;
+        readonly config?: string;
+        readonly binding?: string;
+    };
+    /** Who answers `/mcp` on the app's own host, and why it needs to. */
+    readonly mcp?: {
+        readonly by: "gateway" | "app";
+        readonly why: string;
+    };
+}
+/**
+ * Type `everyapp.config.ts` without widening it: the literal binding names
+ * stay, so `everyAppWorker()` types `env.DB` and `env.EVERYAPP_MANIFEST`
+ * from them. Returns the manifest as given.
+ */
+export declare function defineEveryApp<const M extends EveryAppManifest>(manifest: M): M;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;KACtC,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,qBAAqB,CAAC;KAClD,EAAE,CAAC;IACJ,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;QACzD,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EACZ,4BAA4B,GAC5B,2BAA2B,GAC3B,4BAA4B,GAC5B,+BAA+B,GAC/B,gCAAgC,CAAC;KACtC,EAAE,CAAC;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;QACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC1D,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7D,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;CACL;AAED,oEAAoE;AACpE,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB;IAClB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KACxC,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,UAAU,CAAC;QACrC,gDAAgD;QAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAC1B,MAAM,GACN,CAAC,mBAAmB,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAClD,EAAE,CAAC;IACJ,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAAA;KAAE,CAAC;IAC3E,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,mBAAmB,CAAC,EAAE,CAAC;IAC7D,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,EAAE;QACZ,uEAAuE;QACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,yDAAyD;QACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,+DAA+D;QAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;KAC/C,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAC7D,QAAQ,EAAE,CAAC,GACV,CAAC,CAEH"}

package/dist/manifest.js

@@ -0,0 +1,30 @@
+/**
+ * The manifest an app author writes as `everyapp.config.ts`, typed:
+ *
+ *   import { defineEveryApp } from "@every-app/sdk";
+ *
+ *   export default defineEveryApp({
+ *     id: "notes",
+ *     name: "Notes",
+ *     resources: { d1: ["DB"] },
+ *   });
+ *
+ * Types only, and a leaf module: `cloudflare.config.ts` imports the manifest,
+ * and the Cloudflare Vite plugin hides from the Worker every file the config
+ * imports. The rules beyond the shape (which ids exist, which names are
+ * reserved, which scope sets a provider has) are the CLI's: `everyapp deploy`
+ * and `everyapp dev` validate the manifest and say what is wrong. The
+ * perimeter's schema (`@every-app/perimeter/manifest`) is held to this type
+ * by a test there.
+ *
+ * The Worker reads the manifest back as `env.EVERYAPP_MANIFEST`, which
+ * `everyAppWorker()` sets and `cf workers types` types from the file.
+ */
+/**
+ * Type `everyapp.config.ts` without widening it: the literal binding names
+ * stay, so `everyAppWorker()` types `env.DB` and `env.EVERYAPP_MANIFEST`
+ * from them. Returns the manifest as given.
+ */
+export function defineEveryApp(manifest) {
+    return manifest;
+}